A company uses AWS Organizations to manage several AWS accounts. The company processes a large volume of sensitive data. The company uses a serverless approach to microservices. The company stores…

Question

Options

• ACreate a key policy that allows the kms:Decrypt action only for Amazon S3 and DynamoDB.
• BCreate an IAM policy that denies the kms:Decrypt action for the key. Create a Lambda function
• CCreate a key policy that allows the kms:Decrypt action only for Amazon S3, DynamoDB, Lambda,
• DCreate a key policy that allows the kms:Decrypt action only for Amazon S3, DynamoDB, Lambda,

• A
  7% (2)
• B
  10% (3)
• C
  80% (24)
• D
  3% (1)

Explanation

Option C is correct because a KMS key policy must grant kms:Decrypt to all principals that actually need to decrypt data - both the AWS services storing the data (S3, DynamoDB) and the compute services reading it (Lambda, EKS/Fargate). Granting only to S3 and DynamoDB (Option A) is wrong because those are storage services; the Lambda execution roles and EKS pod roles are the actual consumers that call KMS to decrypt data during reads, so omitting them breaks the solution. Option B is wrong in the opposite direction - denying kms:Decrypt via an IAM policy would block all decryption entirely, making the data unreadable and defeating the purpose. Option D likely grants access too broadly (e.g., to all IAM principals or uses overly permissive conditions), which violates the least privilege requirement that only specific, named services and roles should hold decrypt rights.

Memory tip: Think of KMS key policies as a guest list - you must explicitly name every service and role that needs to enter (decrypt). If you forget Lambda or Fargate on the list, they get turned away at the door even if S3 and DynamoDB are already inside.

No community discussion yet for this question.